Developer
d395aaf574
- Switch apply_resolved_profile from per-file bind mounts to one
directory-level bind mount per ResolvedMount target.
- Stage all configured files under instance_dir/mounts/<sanitized_target>
and bind-mount that directory, so Docker no longer creates a root-owned
parent directory such as ~/.config.
- Propagate read-only mode ('ro') as the 'readonly' flag on volume entries.
- Update unit tests to expect directory-level mounts and add coverage for
readonly/writable flags.
Quality gates: python3 -m py_compile, pytest (313 passed, 34 skipped),
npm run typecheck, npm run lint.
22 lines
1.3 KiB
Markdown
22 lines
1.3 KiB
Markdown
# Config profile directory mounts
|
|
|
|
## Problem
|
|
|
|
`apply_resolved_profile` currently stages each config-profile mount file individually and bind-mounts each file into the container. Docker creates the parent directory (for example `~/.config`) as root-owned when only files are mounted, so applications running as a non-root container user cannot write new files inside that directory.
|
|
|
|
## Decision
|
|
|
|
Stage a directory per mount target and bind-mount the whole directory. The staged directory is created under `instance_dir/mounts/` and is chowned to the resolved container user before the container starts, so the container user can create and modify files inside the target directory.
|
|
|
|
## Scope
|
|
|
|
- Change `apply_resolved_profile` in `apps/api/src/services/config/config_profile_resolver.py` to emit one directory-level volume mount per `ResolvedMount` target.
|
|
- Continue staging all configured files under that directory.
|
|
- Preserve read-only mode by setting `readonly: true` on the volume entry when `mode` is `ro`.
|
|
- Update unit tests in `apps/api/tests/unit/test_config_profile_resolver.py` to expect directory-level mounts.
|
|
|
|
## Non-goals
|
|
|
|
- No changes to git-mount, SSH-key, workspace, or manifest mount handling.
|
|
- No changes to config profile storage or resolution semantics.
|